While most applications require authentication for gaining access to private information or to execute tasks, not every authentication method is able to provide adequate security.

While most applications require authentication for gaining access to private information or to execute tasks, not every authentication method is able to provide adequate security.

−

Negligence, ignorance or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the login page and directly calling an internal page that is supposed to be accessed only after authentication has been performed.

+

Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the login page and directly calling an internal page that is supposed to be accessed only after authentication has been performed.

−

In addition to this, it is often possible to bypass authentication measures by tampering with requests and tricking the application into thinking that we're already authenticated. This can be accomplished either by modifying the given URL parameter or by manipulating the form or by counterfeiting sessions.

+

In addition to this, it is often possible to bypass authentication measures by tampering with requests and tricking the application into thinking that we're already authenticated. This can be accomplished either by modifying the given URL parameter or by manipulating the form or by counterfeiting sessions.

== Description of the Issue ==

== Description of the Issue ==

−

Problems related to Authentication Schema could be found at different stages of software development life cycle (SDLC), like design, development and deployment phase.

+

Problems related to Authentication Schema could be found at different stages of the software development life cycle (SDLC), like design, development, and deployment phase.

Examples of design errors include a wrong definition of application parts to be protected, the choice of not applying strong encryption protocols for securing authentication data exchange, and many more.

Examples of design errors include a wrong definition of application parts to be protected, the choice of not applying strong encryption protocols for securing authentication data exchange, and many more.

−

Problems in the development phase are for example the incorrect implementation of input validation functionalities, or not following the security best practices for the specific language.

+

Problems in the development phase are, for example, the incorrect implementation of input validation functionalities, or not following the security best practices for the specific language.

−

In addition, there are issues during application setup (installation and configuration activities) due to a lack in required technical skills, or due to poor documentation available.

+

In addition, there may be issues during the application setup (installation and configuration activities), due to a lack in required technical skills, or due to poor documentation available.

== Black Box testing and example ==

== Black Box testing and example ==

There are several methods to bypass the authentication schema in use by a web application:

There are several methods to bypass the authentication schema in use by a web application:

−

* Direct page request

+

* Direct page request (forced browsing)

* Parameter Modification

* Parameter Modification

* Session ID Prediction

* Session ID Prediction

−

* Sql Injection

+

* SQL Injection

<br>

<br>

'''Direct page request'''

'''Direct page request'''

−

Several web applications implement access control only inside the login page, otherwise if a user requests directly a different page in the designed protected area, the authentication schema could be bypassed.

+

If a web application implements access control only on the login page, the authentication schema could be bypassed. For example, if a user directly requests a different page via forced browsing, that page may not check the credentials of the user before granting access. Attempt to directly access a protected page through the address bar in your browser to test using this method.

−

[[Image:basm-directreq.jpg]]

+

<center>[[Image:basm-directreq.jpg]]</center>

'''Parameter Modification'''

'''Parameter Modification'''

−

Another problem related to authentication design is to let the application verify a succesful login upon fixed value parameters.

+

Another problem related to authentication design is when the application verifies a successful login on the basis of a fixed value parameters. A user could modify these parameters to gain access to the protected areas without providing valid credentials. In the example below, the "authenticated" parameter is changed to a value of "yes", which allows the user to gain access. In this example, the parameter is in the URL, but a proxy could also be used to modify the parameter, especially when the parameters are sent as form elements in a POST request.

−

Therefore a user could modify these parameters to gain access to the protected areas without providing valid credentials.

<pre>http://www.site.com/page.asp?authenticated=no </pre>

<pre>http://www.site.com/page.asp?authenticated=no </pre>

Line 51:

Line 49:

Connection: close

Connection: close

Content-Type: text/html; charset=iso-8859-1

Content-Type: text/html; charset=iso-8859-1

−

+

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<HTML><HEAD>

<HTML><HEAD>

</HEAD><BODY>

</HEAD><BODY>

<H1>You Are Auhtenticated</H1>

<H1>You Are Auhtenticated</H1>

−

</BODY></HTML></pre>

+

</BODY></HTML>

−

+

</pre>

−

[[Image:basm-parammod.jpg]]

+

<center>[[Image:basm-parammod.jpg]]</center>

'''Session ID Prediction'''

'''Session ID Prediction'''

−

Many web applications manage authentication using session identification values(SESSION ID). Therefore if Session ID generation is predictable a malicious user could be able to find a valid session ID and gain unauthorized access to the application, impersonating a previously authenticated user.

+

Many web applications manage authentication using session identification values (SESSION ID). Therefore, if session ID generation is predictable, a malicious user could be able to find a valid session ID and gain unauthorized access to the application, impersonating a previously authenticated user.

−

In the following figure values inside cookies increase linearly, so could be easy for an attacker to guess a valid session ID.

+

In the following figure, values inside cookies increase linearly, so it could be easy for an attacker to guess a valid session ID.

−

[[Image:basm-sessid.jpg]]

+

<center>[[Image:basm-sessid.jpg]]</center>

−

In the following figure values inside cookies change only partially, so it's possible to restrict a bruteforce attack to the defined fields shown below.

+

In the following figure, values inside cookies change only partially, so it's possible to restrict a brute force attack to the defined fields shown below.

−

[[Image:basm-sessid2.jpg]]

+

<center>[[Image:basm-sessid2.jpg]]</center>

−

'''Sql Injection (HTML Form Authentication)'''

+

'''SQL Injection (HTML Form Authentication)'''

SQL Injection is a widely known attack technique. We are not going to describe this technique in detail in this section; there are several sections in this guide that explain injection techniques beyond the scope of this section.

SQL Injection is a widely known attack technique. We are not going to describe this technique in detail in this section; there are several sections in this guide that explain injection techniques beyond the scope of this section.

−

[[Image:basm-sqlinj.jpg]]

+

<center>[[Image:basm-sqlinj.jpg]]</center>

+

+

The following figure shows that with a simple SQL injection attack, it is sometimes possible to bypass the authentication form.

−

The following figure shows that with simple sql injection, it is possible to bypass the authentication form.

+

<center>[[Image:basm-sqlinj2.gif]]</center>

−

[[Image:basm-sqlinj2.gif]]

+

== Gray Box Testing And Example ==

+

If an attacker has been able to retrieve the application source code by exploiting a previously discovered vulnerability (e.g., directory traversal), or from a web repository (Open Source Applications), it could be possible to perform refined attacks against the implementation of the authentication process.

+

In the following example (PHPBB 2.0.13 - Authentication Bypass Vulnerability), at line 5, the unserialize() function parses a user supplied cookie and sets values inside the $row array. At line 10, the user's md5 password hash stored inside the backend database is compared to the one supplied.

In PHP, a comparison between a string value and a boolean value (1 - "TRUE") is always "TRUE", so by supplying the following string (the important part is "b:1") to the unserialize() function, it is possible to bypass the authentication control:

Brief Summary

While most applications require authentication for gaining access to private information or to execute tasks, not every authentication method is able to provide adequate security.

Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the login page and directly calling an internal page that is supposed to be accessed only after authentication has been performed.

In addition to this, it is often possible to bypass authentication measures by tampering with requests and tricking the application into thinking that we're already authenticated. This can be accomplished either by modifying the given URL parameter or by manipulating the form or by counterfeiting sessions.

Description of the Issue

Problems related to Authentication Schema could be found at different stages of the software development life cycle (SDLC), like design, development, and deployment phase.

Examples of design errors include a wrong definition of application parts to be protected, the choice of not applying strong encryption protocols for securing authentication data exchange, and many more.

Problems in the development phase are, for example, the incorrect implementation of input validation functionalities, or not following the security best practices for the specific language.

In addition, there may be issues during the application setup (installation and configuration activities), due to a lack in required technical skills, or due to poor documentation available.

Black Box testing and example

There are several methods to bypass the authentication schema in use by a web application:

Direct page request (forced browsing)

Parameter Modification

Session ID Prediction

SQL Injection

Direct page request

If a web application implements access control only on the login page, the authentication schema could be bypassed. For example, if a user directly requests a different page via forced browsing, that page may not check the credentials of the user before granting access. Attempt to directly access a protected page through the address bar in your browser to test using this method.

Parameter Modification

Another problem related to authentication design is when the application verifies a successful login on the basis of a fixed value parameters. A user could modify these parameters to gain access to the protected areas without providing valid credentials. In the example below, the "authenticated" parameter is changed to a value of "yes", which allows the user to gain access. In this example, the parameter is in the URL, but a proxy could also be used to modify the parameter, especially when the parameters are sent as form elements in a POST request.

Many web applications manage authentication using session identification values (SESSION ID). Therefore, if session ID generation is predictable, a malicious user could be able to find a valid session ID and gain unauthorized access to the application, impersonating a previously authenticated user.

In the following figure, values inside cookies increase linearly, so it could be easy for an attacker to guess a valid session ID.

In the following figure, values inside cookies change only partially, so it's possible to restrict a brute force attack to the defined fields shown below.

SQL Injection (HTML Form Authentication)

SQL Injection is a widely known attack technique. We are not going to describe this technique in detail in this section; there are several sections in this guide that explain injection techniques beyond the scope of this section.

The following figure shows that with a simple SQL injection attack, it is sometimes possible to bypass the authentication form.

Gray Box Testing And Example

If an attacker has been able to retrieve the application source code by exploiting a previously discovered vulnerability (e.g., directory traversal), or from a web repository (Open Source Applications), it could be possible to perform refined attacks against the implementation of the authentication process.
In the following example (PHPBB 2.0.13 - Authentication Bypass Vulnerability), at line 5, the unserialize() function parses a user supplied cookie and sets values inside the $row array. At line 10, the user's md5 password hash stored inside the backend database is compared to the one supplied.

In PHP, a comparison between a string value and a boolean value (1 - "TRUE") is always "TRUE", so by supplying the following string (the important part is "b:1") to the unserialize() function, it is possible to bypass the authentication control: